Modern networks have many components that interact in complex ways. Changes to the performance or behavior of one component can have a dramatic impact on other components that are in communication with or in some way dependant on the changed component, causing abnormal behavior on all components impacted.
For example, as shown in FIG. 1, an abnormally performing SQL client 102 can impact the behavior of SQL server 104 and another SQL client 106. Abnormal behavior could represent behavior that is either improved or diminished with respect to historical behavior and/or expected behavior. Here, in FIG. 1, the abnormal behavior causes the SQL client 102 to send a larger-than-expected volume of requests 108. Because of the volume of requests 108, SQL server 104 may become less efficient at answering requests, causing longer delays between request submissions and responses. When SQL client 106 submits its expected volume of requests 110, then, it will have to wait longer to receive responses to those requests. This delay in receiving responses can also impact other processes on the SQL client 106, such as application processes utilizing SQL requests and responses. Accordingly, as can be seen in FIG. 1, a problem causing abnormal behavior of one component can impact a large number of other components, causing those other components to behave abnormally as well.
Abnormal behavior of components, as shown in FIG. 1, occurs within both large and small networks. For large networks, there are techniques that are capable of determining which machine on the network is the cause of the abnormal behavior. There are also techniques for determining the cause of the abnormal behavior that require extensive domain knowledge, such as knowledge of each application's dependencies and failure modes.